Skip to content

Commit 3a78d6d

Browse files
mickeyz07mickeyz07
authored
Update the logging properties to opt-out of the prefix events #844 (#845)
* Update the logging properties to opt-out of the prefix events #844 * Update the logging properties to opt-out of the prefix events, second iteration for #844 * Update the logging properties to opt-out of the prefix events, third iteration * Update the logging properties to opt-out of the prefix events #844 fourt iteration * Update the logging properties to opt-out of the prefix events #844 fifth iteration * Update the logging properties to opt-out of the prefix events #844 sixt iteration * Update the logging properties to opt-out of the prefix events #844 seventh iteration * Update the logging properties to opt-out of the prefix events #844 eigth iteration * Update the logging properties to opt-out of the prefix events #844 ninth iteration
1 parent b610633 commit 3a78d6d

File tree

12 files changed

+337
-21
lines changed

12 files changed

+337
-21
lines changed

‎configuration/esapi/ESAPI.properties

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,10 @@ Logger.UserInfo=true
407407
# Determines whether ESAPI should log the session id and client IP.
408408
Logger.ClientInfo=true
409409

410+
# Determines whether ESAPI should log the prefix of [EVENT_TYPE - APPLICATION NAME].
411+
# If all above Logger entries are set to false, as well as LogPrefix, then the output would be the same as if no ESAPI was used
412+
Logger.LogPrefix=true
413+
410414
#===========================================================================
411415
# ESAPI Intrusion Detection
412416
#

‎src/main/java/org/owasp/esapi/PropNames.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ public final class PropNames {
111111
public static final String LOG_ENCODING_REQUIRED = "Logger.LogEncodingRequired";
112112
public static final String LOG_APPLICATION_NAME = "Logger.LogApplicationName";
113113
public static final String LOG_SERVER_IP = "Logger.LogServerIP";
114+
public static final String LOG_PREFIX = "Logger.LogPrefix";
114115

115116
public static final String VALIDATION_PROPERTIES = "Validator.ConfigurationFile";
116117
public static final String VALIDATION_PROPERTIES_MULTIVALUED = "Validator.ConfigurationFile.MultiValued";

‎src/main/java/org/owasp/esapi/logging/appender/EventTypeLogSupplier.java

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,18 +30,24 @@ public class EventTypeLogSupplier // implements Supplier<String>
3030
{
3131
/** EventType reference to supply log representation of. */
3232
private final EventType eventType;
33+
/** Whether to log or not the event type */
34+
private boolean logEventType = true;
3335

3436
/**
3537
* Ctr
3638
*
37-
* @param evtyp EventType reference to supply log representation for
39+
* @param eventType EventType reference to supply log representation for
3840
*/
39-
public EventTypeLogSupplier(EventType evtyp) {
40-
this.eventType = evtyp == null ? Logger.EVENT_UNSPECIFIED : evtyp;
41+
public EventTypeLogSupplier(EventType eventType) {
42+
this.eventType = eventType == null ? Logger.EVENT_UNSPECIFIED : eventType;
4143
}
4244

4345
// @Override -- Uncomment when we switch to Java 8 as minimal baseline.
4446
public String get() {
45-
return eventType.toString();
47+
return logEventType ? eventType.toString() : "";
48+
}
49+
50+
public void setLogEventType(boolean logEventType) {
51+
this.logEventType = logEventType;
4652
}
4753
}

‎src/main/java/org/owasp/esapi/logging/appender/LogPrefixAppender.java

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -35,27 +35,47 @@ public class LogPrefixAppender implements LogAppender {
3535
private final boolean logApplicationName;
3636
/** Application Name to record. */
3737
private final String appName;
38+
/** Whether or not to print the prefix. */
39+
private final boolean logPrefix;
3840

3941
/**
40-
* Ctr.
42+
* Constructor
4143
*
4244
* @param logUserInfo Whether or not to record user information
4345
* @param logClientInfo Whether or not to record client information
4446
* @param logServerIp Whether or not to record server ip information
4547
* @param logApplicationName Whether or not to record application name
4648
* @param appName Application Name to record.
49+
* @param logPrefix is set by default to true
4750
*/
51+
@SuppressWarnings("JavadocReference")
4852
public LogPrefixAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName) {
53+
this(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, true);
54+
}
55+
56+
/**
57+
* Constructor
58+
*
59+
* @param logUserInfo Whether or not to record user information
60+
* @param logClientInfo Whether or not to record client information
61+
* @param logServerIp Whether or not to record server ip information
62+
* @param logApplicationName Whether or not to record application name
63+
* @param appName Application Name to record.
64+
* @param logPrefix Whether or not to print the prefix
65+
*/
66+
public LogPrefixAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName, boolean logPrefix) {
4967
this.logUserInfo = logUserInfo;
5068
this.logClientInfo = logClientInfo;
5169
this.logServerIp = logServerIp;
5270
this.logApplicationName = logApplicationName;
5371
this.appName = appName;
72+
this.logPrefix = logPrefix;
5473
}
5574

5675
@Override
5776
public String appendTo(String logName, EventType eventType, String message) {
5877
EventTypeLogSupplier eventTypeSupplier = new EventTypeLogSupplier(eventType);
78+
eventTypeSupplier.setLogEventType(this.logPrefix);
5979

6080
UserInfoSupplier userInfoSupplier = new UserInfoSupplier();
6181
userInfoSupplier.setLogUserInfo(logUserInfo);
@@ -66,6 +86,7 @@ public String appendTo(String logName, EventType eventType, String message) {
6686
ServerInfoSupplier serverInfoSupplier = new ServerInfoSupplier(logName);
6787
serverInfoSupplier.setLogServerIp(logServerIp);
6888
serverInfoSupplier.setLogApplicationName(logApplicationName, appName);
89+
serverInfoSupplier.setLogLogName(logPrefix);
6990

7091
String eventTypeMsg = eventTypeSupplier.get().trim();
7192
String userInfoMsg = userInfoSupplier.get().trim();
@@ -80,17 +101,20 @@ public String appendTo(String logName, EventType eventType, String message) {
80101

81102
String[] optionalPrefixContent = new String[] {userInfoMsg + clientInfoMsg, serverInfoMsg};
82103

83-
StringBuilder logPrefix = new StringBuilder();
84-
//EventType is always appended
85-
logPrefix.append(eventTypeMsg);
104+
StringBuilder logPrefixBuilder = new StringBuilder();
105+
//EventType is always appended (unless we specifically asked not to Log Prefix)
106+
if (this.logPrefix) {
107+
logPrefixBuilder.append(eventTypeMsg);
108+
}
86109

87110
for (String element : optionalPrefixContent) {
88111
if (!element.isEmpty()) {
89-
logPrefix.append(" ");
90-
logPrefix.append(element);
112+
logPrefixBuilder.append(" ");
113+
logPrefixBuilder.append(element);
91114
}
92115
}
93116

94-
return String.format(RESULT_FORMAT, logPrefix.toString(), message);
117+
String logPrefixContent = logPrefixBuilder.toString();
118+
return logPrefixContent.trim().isEmpty() ? message : String.format(RESULT_FORMAT, logPrefixContent, message);
95119
}
96120
}

‎src/main/java/org/owasp/esapi/logging/appender/ServerInfoSupplier.java

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ public class ServerInfoSupplier // implements Supplier<String>
3434
private boolean logAppName = true;
3535
/** The application name to log. */
3636
private String applicationName = "";
37-
37+
/** Whether to log the Name */
38+
private boolean logLogName = true;
3839
/** Reference to the associated logname/module name. */
3940
private final String logName;
4041

@@ -57,10 +58,14 @@ public String get() {
5758
appInfo.append(request.getLocalAddr()).append(":").append(request.getLocalPort());
5859
}
5960
}
60-
if (logAppName) {
61-
appInfo.append("/").append(applicationName);
61+
62+
if (this.logAppName) {
63+
appInfo.append("/").append(this.applicationName);
64+
}
65+
66+
if (this.logLogName) {
67+
appInfo.append("/").append(logName);
6268
}
63-
appInfo.append("/").append(logName);
6469

6570
return appInfo.toString();
6671
}
@@ -74,6 +79,15 @@ public void setLogServerIp(boolean log) {
7479
this.logServerIP = log;
7580
}
7681

82+
/**
83+
* Specify whether the instance should record the prefix.
84+
*
85+
* @param logLogName {@code true} to record
86+
*/
87+
public void setLogLogName(boolean logLogName) {
88+
this.logLogName = logLogName;
89+
}
90+
7791
/**
7892
* Specify whether the instance should record the application name
7993
*

‎src/main/java/org/owasp/esapi/logging/java/JavaLogFactory.java

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
2121
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
2222
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
23+
import static org.owasp.esapi.PropNames.LOG_PREFIX;
2324

2425
import java.io.IOException;
2526
import java.io.InputStream;
@@ -79,7 +80,17 @@ public class JavaLogFactory implements LogFactory {
7980
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
8081
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
8182
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
82-
JAVA_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
83+
84+
boolean logPrefix = true;
85+
try {
86+
logPrefix = ESAPI.securityConfiguration().getBooleanProp(LOG_PREFIX);
87+
} catch (ConfigurationException ex) {
88+
System.out.println("ESAPI: Failed to read Log Prefix configuration " + LOG_PREFIX + ". Defaulting to enabled" +
89+
". Caught " + ex.getClass().getName() +
90+
"; exception message was: " + ex);
91+
}
92+
93+
JAVA_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
8394

8495
Map<Integer, JavaLogLevelHandler> levelLookup = new HashMap<>();
8596
levelLookup.put(Logger.ALL, JavaLogLevelHandlers.ALWAYS);
@@ -144,6 +155,20 @@ public class JavaLogFactory implements LogFactory {
144155
return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
145156
}
146157

158+
/**
159+
* Populates the default log appender for use in factory-created loggers.
160+
* @param appName
161+
* @param logApplicationName
162+
* @param logServerIp
163+
* @param logClientInfo
164+
* @param logPrefix
165+
*
166+
* @return LogAppender instance.
167+
*/
168+
/*package*/ static LogAppender createLogAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName, boolean logPrefix) {
169+
return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
170+
}
171+
147172

148173
@Override
149174
public Logger getLogger(String moduleName) {

‎src/main/java/org/owasp/esapi/logging/slf4j/Slf4JLogFactory.java

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import org.owasp.esapi.LogFactory;
2424
import org.owasp.esapi.Logger;
2525
import org.owasp.esapi.codecs.HTMLEntityCodec;
26+
import org.owasp.esapi.errors.ConfigurationException;
2627
import org.owasp.esapi.logging.appender.LogAppender;
2728
import org.owasp.esapi.logging.appender.LogPrefixAppender;
2829
import org.owasp.esapi.logging.cleaning.CodecLogScrubber;
@@ -36,6 +37,7 @@
3637
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
3738
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
3839
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
40+
import static org.owasp.esapi.PropNames.LOG_PREFIX;
3941
import org.slf4j.LoggerFactory;
4042
/**
4143
* LogFactory implementation which creates SLF4J supporting Loggers.
@@ -69,7 +71,17 @@ public class Slf4JLogFactory implements LogFactory {
6971
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
7072
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
7173
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
72-
SLF4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
74+
75+
boolean logPrefix = true;
76+
try {
77+
logPrefix = ESAPI.securityConfiguration().getBooleanProp(LOG_PREFIX);
78+
} catch (ConfigurationException ex) {
79+
System.out.println("ESAPI: Failed to read Log Prefix configuration " + LOG_PREFIX + ". Defaulting to enabled" +
80+
". Caught " + ex.getClass().getName() +
81+
"; exception message was: " + ex);
82+
}
83+
84+
SLF4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
7385

7486
Map<Integer, Slf4JLogLevelHandler> levelLookup = new HashMap<>();
7587
levelLookup.put(Logger.ALL, Slf4JLogLevelHandlers.TRACE);
@@ -114,6 +126,19 @@ public class Slf4JLogFactory implements LogFactory {
114126
return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
115127
}
116128

129+
/**
130+
* Populates the default log appender for use in factory-created loggers.
131+
* @param appName
132+
* @param logApplicationName
133+
* @param logServerIp
134+
* @param logClientInfo
135+
* @param logPrefix
136+
*
137+
* @return LogAppender instance.
138+
*/
139+
/*package*/ static LogAppender createLogAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName, boolean logPrefix) {
140+
return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
141+
}
117142

118143
@Override
119144
public Logger getLogger(String moduleName) {

‎src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1441,14 +1441,14 @@ public Boolean getBooleanProp(String propertyName) throws ConfigurationException
14411441
try {
14421442
return esapiPropertyManager.getBooleanProp(propertyName);
14431443
} catch (ConfigurationException ex) {
1444-
String property = properties.getProperty( propertyName );
1444+
String property = properties.getProperty(propertyName);
14451445
if ( property == null ) {
14461446
throw new ConfigurationException( "SecurityConfiguration for " + propertyName + " not found in ESAPI.properties");
14471447
}
1448-
if ( property.equalsIgnoreCase("true") || property.equalsIgnoreCase("yes" ) ) {
1448+
if ( property.equalsIgnoreCase("true") || property.equalsIgnoreCase("yes") ) {
14491449
return true;
14501450
}
1451-
if ( property.equalsIgnoreCase("false") || property.equalsIgnoreCase( "no" ) ) {
1451+
if ( property.equalsIgnoreCase("false") || property.equalsIgnoreCase("no") ) {
14521452
return false;
14531453
}
14541454
throw new ConfigurationException( "SecurityConfiguration for " + propertyName + " has incorrect " +

‎src/test/java/org/owasp/esapi/logging/appender/EventTypeLogSupplierIgnoreEventTypeTest.java

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
package org.owasp.esapi.logging.appender;
2+
3+
import static org.junit.Assert.assertEquals;
4+
5+
import org.junit.Test;
6+
import org.junit.runner.RunWith;
7+
import org.junit.runners.Parameterized;
8+
import org.owasp.esapi.Logger;
9+
10+
import java.util.ArrayList;
11+
import java.util.Collection;
12+
import java.util.List;
13+
14+
@RunWith(Parameterized.class)
15+
public class EventTypeLogSupplierIgnoreEventTypeTest {
16+
17+
@Parameterized.Parameters (name="{0} -> {1}")
18+
public static Collection<Object[]> assembleTests() {
19+
List<Object[]> paramSets = new ArrayList<>();
20+
paramSets.add(new Object[] {Logger.EVENT_FAILURE,""});
21+
paramSets.add(new Object[] {Logger.EVENT_SUCCESS,""});
22+
paramSets.add(new Object[] {Logger.EVENT_UNSPECIFIED,""});
23+
paramSets.add(new Object[] {Logger.SECURITY_AUDIT,""});
24+
paramSets.add(new Object[] {Logger.SECURITY_FAILURE,""});
25+
paramSets.add(new Object[] {Logger.SECURITY_SUCCESS,""});
26+
paramSets.add(new Object[] {null, ""});
27+
28+
return paramSets;
29+
}
30+
31+
private final Logger.EventType eventType;
32+
private final String expectedResult;
33+
34+
public EventTypeLogSupplierIgnoreEventTypeTest(Logger.EventType eventType, String result) {
35+
this.eventType = eventType;
36+
this.expectedResult = result;
37+
}
38+
39+
@Test
40+
public void testEventTypeLogIgnoreEventType() {
41+
EventTypeLogSupplier supplier = new EventTypeLogSupplier(eventType);
42+
supplier.setLogEventType(false);
43+
assertEquals(expectedResult, supplier.get());
44+
}
45+
}

0 commit comments

Comments
 (0)